S. 3404 — Satellite Cybersecurity Act of 2025

This section defines terms for the Act, including the appropriate congressional committees, the commercial satellite system cybersecurity clearinghouse, a commercial satellite system (i.e., a non-Federal system with at least one earth satellite and related ground infrastructure), critical infrastructure, cybersecurity risk, cybersecurity threat, and the Secretary of Commerce.

This section directs the Comptroller General to study federal government actions supporting the cybersecurity of commercial satellite systems, including their role in critical infrastructure sectors, and to report findings to the appropriate congressional committees within 2 years of enactment. The report must cover the effectiveness of those efforts, public resources available, agency reliance on such systems, risks from foreign ownership or infrastructure, coordination across agencies, and recommendations for information sharing, while consulting with 12 specified agencies and organizations; the report must remain unclassified but may include a classified annex.

This section establishes a commercial satellite system cybersecurity clearinghouse within 180 days of enactment as a public online repository for resources, guidance, and voluntary recommendations. It directs the Secretary of Commerce, in coordination with the Secretary of Homeland Security and other agencies, to consolidate recommendations addressing risk-based engineering, positive control retention, jamming, spoofing, supply chain risks, foreign ownership, and foreign infrastructure location; requires materials targeted at small business concerns; mandates private-sector partnership and consultations; and requires reports to Congress every two years for nine years.

This section requires the Secretary, jointly with the National Space Council and the Office of the National Cyber Director and in coordination with the Secretary of Homeland Security and other specified officials, to submit within 120 days of enactment a strategy for coordination, information sharing, and voluntary best practices on cybersecurity of commercial satellite systems. The strategy must identify proposed agency coordination roles and the extent to which such threats are addressed in critical infrastructure risk analyses, protection plans, and related activities.

This section limits the Act by prohibiting the designation of commercial satellite systems or other space assets as a critical infrastructure sector, the infringement or alteration of authorities held by specified agencies, the development or implementation of any rulemaking or regulatory requirements for commercial satellite systems, and the modification or expansion of authorities held by the Committee on Foreign Investment in the United States or the Committee for the Assessment of Foreign Participation in the United States Telecommunications Service Sector.